Update

Examples/Example-00-GPOPermissionTypes.ps1

@@ -0,0 +1,24 @@
+$GPPermissions = [ordered] @{
+    GpoApply                    = 'The trustee can apply the GPO; corresponds to the READ and APPLY Group Policy access rights being set to "Allow" for a user.'
+    GpoCustom                   = 'The trustee has custom permissions for the GPO.'
+    GpoEdit                     = 'The trustee can read and edit the policy settings for the GPO; corresponds to the READ, WRITE, CREATE CHILD OBJECT, and DELETE CHILD OBJECT Group Policy access rights set to "Allow" for a user.'
+    GpoEditDeleteModifySecurity = 'The trustee can read, edit and delete the permissions for the GPO; corresponds to the Group Policy access rights specified by GpoEdit plus the DELETE, MODIFY PERMISSIONS, and MODIFY OWNER access rights set to "Allow" for a user.'
+    GpoRead                     = 'The trustee can read the GPO; corresponds to the READ Group Policy access right set to "Allow" for a user.'
+    None                        = 'This value is reserved for internal use by the Group Policy Windows PowerShell cmdlets.'
+    SomCreateGpo                = 'The trustee can create GPOs in the domain. Applies to domains only.'
+    SomCreateStarterGpo         = 'The trustee can create Starter GPOs in the domain. Applies to domains only.'
+    SomCreateWmiFilter          = 'The trustee can create WMI filters in the domain. Applies to domains only.'
+    SomLink                     = 'The trustee can link GPOs to the SOM. Applies to sites, domains and OUs.'
+    SomLogging                  = 'The trustee can generate RSoP logging data for the SOM. Applies to domains and OUs.'
+    SomPlanning                 = 'The trustee can generate RSoP planning data for the SOM. Applies to domains and OUs.'
+    SomWmiFilterFullControl     = 'The trustee has full control over all WMI filters in the domain. Applies to domains only.'
+    StarterGpoCustom            = 'The trustee has custom permissions for the Starter GPO.'
+    StarterGpoEdit              = 'The trustee can read and edit the administrative template policy settings for the Starter GPO; corresponds to the READ, WRITE, CREATE CHILD OBJECT, and DELETE CHILD OBJECT Group Policy access rights set to "Allow" for a user.'
+    StarterGpoFullControl       = 'The trustee has full control for the Starter GPO. Applies to domains only.'
+    StarterGpoRead              = 'The trustee can read the Starter GPO; corresponds to the READ Group Policy access right set to "Allow" for a user.'
+    WmiFilterCustom             = 'The trustee has custom permissions for the WMI filter.'
+    WmiFilterEdit               = 'The trustee can edit the WMI filter.'
+    WmiFilterFullControl        = 'The trustee has full control over the WMI filter.'
+}
+
+$GPPermissions | Format-Table

Examples/Example-01-BackupGPOs.ps1

@@ -2,7 +2,7 @@
 
 # Backup GPOs
 $BackupPath = "$Env:UserProfile\Desktop\GPO"
-$GPOSummary = Backup-GPOZaurr -BackupPath $BackupPath -Verbose -Type EmptyAndUnlinked -BackupDated #-LimitProcessing 1
+$GPOSummary = Backup-GPOZaurr -BackupPath $BackupPath -Verbose -Type Unlinked -BackupDated #-LimitProcessing 1
 $GPOSummary | Format-Table -AutoSize
 
 # Confirm GPOs are backed up properly

Examples/Example-02-RemoveEmptyAndUnlinkedGPOs.ps1

@@ -2,4 +2,4 @@
 
 # Remove GPOS
 $BackupPath = "$Env:UserProfile\Desktop\GPO"
-Remove-GPOZaurr -Type EmptyAndUnlinked -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose
+Remove-GPOZaurr -Type Empty -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose

Examples/Example-03-RestoreGPO.ps1

@@ -1,6 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-02_20_20_04'
+$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-12_10_11_24'
 
 $BackupInformation = Get-GPOZaurrBackupInformation -BackupFolder $RestoreFrom
 $BackupInformation | Format-Table -a
@@ -10,5 +10,5 @@ $RestoredGPOs = Restore-GPOZaurr -BackupFolder $RestoreFrom -Verbose
 $RestoredGPOs | Format-Table -AutoSize
 
 # restore just one Gpo
-$RestoredGPOs = Restore-GPOZaurr -BackupFolder $RestoreFrom -Verbose -DisplayName 'Users | Synced Office 365 Users'
-$RestoredGPOs | Format-Table -AutoSize
+#$RestoredGPOs = Restore-GPOZaurr -BackupFolder $RestoreFrom -Verbose -DisplayName 'Users | Synced Office 365 Users'
+#$RestoredGPOs | Format-Table -AutoSize

Examples/Example-07-CreatingWMIFilters.ps1

@@ -1,7 +1,7 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 # By default it creates WMI filter in $Env:USERDNSDOMAIN if no Forest/IncludeDomains/ExcludeDomains are specified
-New-GPOZaurrWMI -Query 'select * from Win32_OperatingSystem where Version like "6.0%" and ProductType = "3"' -Name 'Test' -Verbose -Force
+New-GPOZaurrWMI -Query 'select * from Win32_OperatingSystem where Version like "6.0%" and ProductType = "3"' -Name 'Test' -Verbose #-Force
 
 # If you want to force creation of same filter in all domains of a forest (this overwrites set value)
 #New-GPOZaurrWMI -Query 'select * from Win32_OperatingSystem where Version like "6.0%" and ProductType = "3"' -Name 'Test' -Verbose -Forest 'ad.evotec.xyz' -WhatIf

Examples/Example-08-ListingPermissions.ps1

@@ -1,16 +1,7 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-#$GPOS = Get-GPOZaurr
-#$GPOS | Format-Table -AutoSize
+#$T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown
 
-#$GPOS[0] | Format-List
-
-#$GPOs[0].ACL | Format-Table -AutoSize
-
-#Get-GPOZaurrPermissions | Format-Table -AutoSize
-$T = Get-GPOZaurrPermissions #| Out-HtmlView
-#$T[0] | Format-List *
-$T | Format-Table -AutoSize
-#$T[0].Trustee
-#$T[0].Permission
-#$T[0]
+$T = Get-GPOZaurrPermission -ResolveAccounts -IncludeOwner #-ExcludePermissionType GpoRead,GpoApply #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
+$T | Format-Table -AutoSize *
+$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging

Examples/Example-09-RemovingGPOPermissionUnknown.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Remove-GPOZaurrPermission -Verbose -Type Unknown -WhatIf

Examples/Example-09-RemovingGPOpermissionNamed.ps1

@@ -0,0 +1,13 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Named = @(
+    'S-1-5-21-853615985-2870445339-3163598659-1105'
+)
+
+# Using exclude permission types (it may not be good idea to delete GPORead/GPOApply)
+#Remove-GPOZaurrPermission -Verbose -Type Named -WhatIf -LimitProcessing 2 -NamedObjects $Named -ExcludePermissionType GpoRead,GpoApply
+
+# But
+#Remove-GPOZaurrPermission -Type Named -NamedObjects $Named -IncludePermissionType GpoEditDeleteModifySecurity -SkipWellKnown -SkipAdministrative -Verbose -WhatIf
+
+Remove-GPOZaurrPermission -Type Named -NamedObjects $Named -SkipWellKnown -SkipAdministrative -Verbose #-WhatIf

Examples/Example-10-ReplaceGPOOwner.ps1

@@ -0,0 +1,21 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$LImitProcessing = 2
+
+# check what is there now
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID
+$Count = 0
+
+# loop thru all GPOS (or use LimitProcessing)
+foreach ($GPO in $GPOS) {
+    $Count++
+    Set-GPOZaurrOwner -GPOID $GPO.GUID -Verbose -Principal 'przemyslaw.klys@evotec.pl' #-WhatIf
+    if ($Count -eq $LImitProcessing) {
+        break
+    }
+}
+
+# Confirm what changed
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID

Examples/Example-11-ReplaceGPOOwnerAutomated.ps1

@@ -0,0 +1,13 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This Example shows how to deal with GPOs that have owner that doesn't exists anymore (deleted userr or diff domain) - EmptyOrUnknown
+# And also can fix at the same time NonAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
+# regardless if current user is still Domain Admin or not
+
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID
+
+Set-GPOZaurrOwner -Type 'NonAdministrative','EmptyOrUnknown' -Verbose -LimitProcessing 3 #-WhatIf
+
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID

Examples/Example-12-GPOInformationPermissionOnly.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$GPOS = Get-GPOZaurr -PermissionsOnly
+# to screen
+$GPOS | Format-Table -AutoSize
+# to html
+#$GPOS | Out-HtmlView
+# to excel
+#$GPOS | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOExport.xlsx -ExcelWorkSheetName 'Permissions' -AutoFit -AutoFilter

Examples/Example-13-ListingOwners.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Owners = Get-GPOZaurr -OwnerOnly
+$Owners | Format-Table

GPOZaurr.psd1

@@ -5,9 +5,9 @@
     CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
     Description          = 'Group Policy Eater'
-    FunctionsToExport    = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermissions', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles'
+    FunctionsToExport    = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.7'
+    ModuleVersion        = '0.0.14'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -17,9 +17,13 @@
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.134'
+        ModuleVersion = '0.0.135'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
+    }, @{
+        ModuleVersion = '0.0.48'
+        ModuleName    = 'ADEssentials'
+        Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
     }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
     RootModule           = 'GPOZaurr.psm1'
 }

Private/ConvertTo-TableFormat.ps1

@@ -1,45 +0,0 @@
-function ConvertTo-TableFormat {
-    <#
-    .SYNOPSIS
-        Rebuild an object based on the Format Data for the object.
-    .DESCRIPTION
-        Allows an object to be rebuilt based on the view data for the object. Uses Select-Object to create a new PSCustomObject.
-    #>
-    [CmdletBinding()]
-    param (
-        [Parameter(ValueFromPipeline)]
-        [Object]$InputObject
-    )
-    begin {
-        $isFirst = $true
-    }
-    process {
-        $format = if ($isFirst) {
-            $formatData = Get-FormatData -TypeName $InputObject.PSTypeNames | Select-Object -First 1
-            if ($formatData) {
-                $viewDefinition = $formatData.FormatViewDefinition | Where-Object Control -match 'TableControl'
-
-                for ($i = 0; $i -lt $viewDefinition.Control.Headers.Count; $i++) {
-                    $name = $viewDefinition.Control.Headers[$i].Label
-
-                    $displayEntry = $viewDefinition.Control.Rows.Columns[$i].DisplayEntry
-                    if (-not $name) {
-                        $name = $displayEntry.Value
-                    }
-
-                    $expression = switch ($displayEntry.ValueType) {
-                        'Property' { $displayEntry.Value }
-                        'ScriptBlock' { [ScriptBlock]::Create($displayEntry.Value) }
-                    }
-
-                    @{ Name = $name; Expression = $expression }
-                }
-            }
-        }
-        if ($format) {
-            $InputObject | Select-Object -Property $format
-        } else {
-            $InputObject
-        }
-    }
-}

Private/Get-ADAdministrativeGroups.ps1

@@ -0,0 +1,74 @@
+
+function Get-ADADministrativeGroups {
+    <#
+    .SYNOPSIS
+    Short description
+
+    .DESCRIPTION
+    Long description
+
+    .PARAMETER Type
+    Parameter description
+
+    .PARAMETER Forest
+    Parameter description
+
+    .PARAMETER ExcludeDomains
+    Parameter description
+
+    .PARAMETER IncludeDomains
+    Parameter description
+
+    .PARAMETER ExtendedForestInformation
+    Parameter description
+
+    .EXAMPLE
+    Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins
+
+    Output (Where VALUE is Get-ADGroup output):
+    Name                           Value
+    ----                           -----
+    ByNetBIOS                      {EVOTEC\Domain Admins, EVOTEC\Enterprise Admins, EVOTECPL\Domain Admins}
+    ad.evotec.xyz                  {DomainAdmins, EnterpriseAdmins}
+    ad.evotec.pl                   {DomainAdmins}
+
+    .NOTES
+    General notes
+    #>
+    [cmdletBinding()]
+    param(
+        [parameter(Mandatory)][validateSet('DomainAdmins', 'EnterpriseAdmins')][string[]] $Type,
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ADDictionary = [ordered] @{ }
+    $ADDictionary['ByNetBIOS'] = [ordered] @{ }
+    $ADDictionary['BySID'] = [ordered] @{ }
+
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        $ADDictionary[$Domain] = [ordered] @{ }
+        $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+        $DomainInformation = Get-ADDomain -Server $QueryServer
+
+        if ($Type -contains 'DomainAdmins') {
+            Get-ADGroup -Filter "SID -eq '$($DomainInformation.DomainSID)-512'" -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
+                $ADDictionary['ByNetBIOS']["$($DomainInformation.NetBIOSName)\$($_.Name)"] = $_
+                $ADDictionary[$Domain]['DomainAdmins'] = "$($DomainInformation.NetBIOSName)\$($_.Name)"
+                $ADDictionary['BySID'][$_.SID.Value] = $_
+            }
+        }
+        if ($Type -contains 'EnterpriseAdmins') {
+            Get-ADGroup -Filter "SID -eq '$($DomainInformation.DomainSID)-519'" -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
+                $ADDictionary['ByNetBIOS']["$($DomainInformation.NetBIOSName)\$($_.Name)"] = $_
+                $ADDictionary[$Domain]['EnterpriseAdmins'] = "$($DomainInformation.NetBIOSName)\$($_.Name)"
+                $ADDictionary['BySID'][$_.SID.Value] = $_ #"$($DomainInformation.NetBIOSName)\$($_.Name)"
+            }
+        }
+    }
+    return $ADDictionary
+}
+
+#Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins

Private/Get-PrivPermission.ps1

@@ -0,0 +1,145 @@
+function Get-PrivPermission {
+    [cmdletBinding()]
+    param(
+        [Microsoft.GroupPolicy.Gpo] $GPO,
+        [switch] $SkipWellKnown,
+        [switch] $SkipAdministrative,
+        [switch] $IncludeOwner,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [switch] $IncludeGPOObject,
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+        [string[]] $Type,
+        [System.Collections.IDictionary] $Accounts
+    )
+    Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
+    $SecurityRights = $GPO.GetSecurityInfo()
+    $SecurityRights | ForEach-Object -Process {
+        #Get-GPPermissions -Guid $GPO.ID -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
+        $GPOPermission = $_
+        if ($ExcludePermissionType -contains $GPOPermission.Permission) {
+            return
+        }
+        if ($IncludePermissionType) {
+            if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
+                return
+            }
+        }
+        if ($SkipWellKnown.IsPresent) {
+            if ($GPOPermission.Trustee.SidType -eq 'WellKnownGroup') {
+                return
+            }
+        }
+        if ($SkipAdministrative.IsPresent) {
+            $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
+            if ($IsAdministrative) {
+                return
+            }
+        }
+        if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
+            # May need updates if there's more types
+            if ($GPOPermission.Trustee.SidType -ne 'Unknown') {
+                return
+            }
+        }
+        $ReturnObject = [ordered] @{
+            DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+            GUID              = $GPO.ID
+            DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+            Enabled           = $GPO.GpoStatus
+            Description       = $GPO.Description
+            CreationDate      = $GPO.CreationTime
+            ModificationTime  = $GPO.ModificationTime
+            Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
+            Inherited         = $GPOPermission.Inherited   # : False
+            Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
+            DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+            Name              = $GPOPermission.Trustee.Name    #: Domain Admins
+            Sid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+            SidType           = $GPOPermission.Trustee.SidType #: Group
+        }
+        if ($Accounts) {
+            $A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+            #$TranslatedUser = $Accounts[$A]
+            $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+            $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+            $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+            $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+            if ($Accounts[$A].ObjectClass -eq 'group') {
+                $ReturnObject['SidType'] = 'Group'
+            } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                $ReturnObject['SidType'] = 'user'
+            } #else {
+
+            #}
+        }
+        if ($IncludeGPOObject) {
+            $ReturnObject['GPOObject'] = $GPO
+            $ReturnObject['GPOSecurity'] = $SecurityRights
+        }
+        [PSCustomObject] $ReturnObject
+    }
+    if ($IncludeOwner.IsPresent) {
+        if ($GPO.Owner) {
+            $SplittedOwner = $GPO.Owner.Split('\')
+            $DomainOwner = $SplittedOwner[0]  #: EVOTEC
+            $DomainUserName = $SplittedOwner[1]   #: Domain Admins
+            $SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
+            if ($SID) {
+                $SIDType = 'Group'
+                $DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
+            } else {
+                $SIDType = ''
+                $DistinguishedName = ''
+            }
+        } else {
+            $DomainOwner = $GPO.Owner
+            $DomainUserName = ''
+            $SID = ''
+            $SIDType = 'EmptyOrUnknown'
+            $DistinguishedName = ''
+        }
+        $ReturnObject = [ordered] @{
+            DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+            GUID              = $GPO.Id
+            DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+            Enabled           = $GPO.GpoStatus
+            Description       = $GPO.Description
+            CreationDate      = $GPO.CreationTime
+            ModificationTime  = $GPO.ModificationTime
+            Permission        = 'GpoOwner'  # : GpoEditDeleteModifySecurity
+            Inherited         = $false  # : False
+            Domain            = $DomainOwner
+            DistinguishedName = $DistinguishedName  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+            Name              = $DomainUserName
+            Sid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+            SidType           = $SIDType #  #: Group
+        }
+        if ($Accounts) {
+            $A = $GPO.Owner
+            #$TranslatedUser = $Accounts[$A]
+            $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+            $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+            $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
+            $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+            $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+            if (-not $ReturnObject['Sid']) {
+                $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
+            }
+            if ($Accounts[$A].ObjectClass -eq 'group') {
+                $ReturnObject['SidType'] = 'Group'
+            } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                $ReturnObject['SidType'] = 'User'
+            } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
+                $ReturnObject['SidType'] = 'Computer'
+            } else {
+                $ReturnObject['SidType'] = 'EmptyOrUnknown'
+            }
+        }
+        if ($IncludeGPOObject) {
+            $ReturnObject.GPOObject = $GPO
+            $ReturnObject.GPOSecurity = $SecurityRights
+        }
+        [PSCustomObject] $ReturnObject
+    }
+}

Private/Get-XMLGPO.ps1

@@ -2,7 +2,10 @@
     [cmdletBinding()]
     param(
         [XML] $XMLContent,
-        [Microsoft.GroupPolicy.Gpo] $GPO
+        [Microsoft.GroupPolicy.Gpo] $GPO,
+        [switch] $PermissionsOnly,
+        [switch] $OwnerOnly,
+        [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     if ($XMLContent.GPO.LinksTo) {
         $Linked = $true
@@ -33,64 +36,129 @@
     } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) {
         $Enabled = 'User configuration settings disabled'
     }
-
-    [PsCustomObject] @{
-        'Name'                              = $XMLContent.GPO.Name
-        'Domain'                            = $XMLContent.GPO.Identifier.Domain.'#text'
-        'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText
-        'Linked'                            = $Linked
-        'LinksCount'                        = $LinksCount
-        'Enabled'                           = $Enabled
-        'ComputerEnabled'                   = $ComputerEnabled
-        'UserEnabled'                       = $UserEnabled
-        'ComputerSettingsAvailable'         = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
-        'UserSettingsAvailable'             = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
-        'ComputerSettingsStatus'            = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
-        'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
-        'ComputerSettings'                  = $XMLContent.GPO.Computer.ExtensionData.Extension
-        'UserSettingsStatus'                = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
-        'UserSettingsVersionIdentical'      = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
-        'UserSettings'                      = $XMLContent.GPO.User.ExtensionData.Extension
-
-        'CreationTime'                      = [DateTime] $XMLContent.GPO.CreatedTime
-        'ModificationTime'                  = [DateTime] $XMLContent.GPO.ModifiedTime
-        'ReadTime'                          = [DateTime] $XMLContent.GPO.ReadTime
-
-        'WMIFilter'                         = $GPO.WmiFilter.name
-        'WMIFilterDescription'              = $GPO.WmiFilter.Description
-        'Path'                              = $GPO.Path
-        'SDDL'                              = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
-        'Owner'                             = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
-        'OwnerSID'                          = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
-        'ACL'                               = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
+    if (-not $PermissionsOnly) {
+        if ($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text') {
+            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text')"]
+            $WellKnown = ConvertFrom-SID -SID $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text' -OnlyWellKnown
+            if ($AdministrativeGroup) {
+                $OwnerType = 'Administrative'
+            } elseif ($WellKnown.Name) {
+                $OwnerType = 'WellKnown'
+            } else {
+                $OwnerType = 'NonAdministrative'
+            }
+        } else {
+            $OwnerType = 'EmptyOrUnknown'
+        }
+    }
+    if ($PermissionsOnly) {
+        [PsCustomObject] @{
+            'DisplayName'    = $XMLContent.GPO.Name
+            'DomainName'     = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'           = $XMLContent.GPO.Identifier.Identifier.InnerText
+            'Enabled'        = $Enabled
+            'Name'           = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'Sid'            = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            #'SidType'        = if (($XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text').Length -le 10) { 'WellKnown' } else { 'Other' }
+            'PermissionType' = 'Allow'
+            'Inherited'      = $false
+            'Permissions'    = 'Owner'
+        }
+        $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
             if ($_) {
                 [PsCustomObject] @{
+                    'DisplayName'    = $XMLContent.GPO.Name
+                    'DomainName'     = $XMLContent.GPO.Identifier.Domain.'#text'
+                    'GUID'           = $XMLContent.GPO.Identifier.Identifier.InnerText
+                    'Enabled'        = $Enabled
                     'Name'           = $_.trustee.name.'#Text'
                     'Sid'            = $_.trustee.SID.'#Text'
+                    #'SidType'        = if (($XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text').Length -le 10) { 'WellKnown' } else { 'Other' }
                     'PermissionType' = $_.type.PermissionType
-                    'Inherited'      = $_.Inherited
+                    'Inherited'      = if ($_.Inherited -eq 'false') { $false } else { $true }
                     'Permissions'    = $_.Standard.GPOGroupedAccessEnum
                 }
             }
         }
-        'Auditing'                          = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false }
-        'Links'                             = $XMLContent.GPO.LinksTo | ForEach-Object -Process {
-            if ($_) {
-                [PSCustomObject] @{
-                    CanonicalName = $_.SOMPath
-                    Enabled       = $_.Enabled
-                    NoOverride    = $_.NoOverride
+    } elseif ($OwnerOnly) {
+        [PsCustomObject] @{
+            'DisplayName' = $XMLContent.GPO.Name
+            'DomainName'  = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'        = $XMLContent.GPO.Identifier.Identifier.InnerText
+            'Enabled'     = $Enabled
+            'Owner'       = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'OwnerSID'    = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'   = $OwnerType
+        }
+    } else {
+        [PsCustomObject] @{
+            'DisplayName'                       = $XMLContent.GPO.Name
+            'DomainName'                        = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText
+            'Linked'                            = $Linked
+            'LinksCount'                        = $LinksCount
+            'Enabled'                           = $Enabled
+            'ComputerEnabled'                   = $ComputerEnabled
+            'UserEnabled'                       = $UserEnabled
+            'ComputerSettingsAvailable'         = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
+            'UserSettingsAvailable'             = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
+            'ComputerSettingsStatus'            = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
+            'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
+            'ComputerSettings'                  = $XMLContent.GPO.Computer.ExtensionData.Extension
+            'UserSettingsStatus'                = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
+            'UserSettingsVersionIdentical'      = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
+            'UserSettings'                      = $XMLContent.GPO.User.ExtensionData.Extension
+
+            'CreationTime'                      = [DateTime] $XMLContent.GPO.CreatedTime
+            'ModificationTime'                  = [DateTime] $XMLContent.GPO.ModifiedTime
+            'ReadTime'                          = [DateTime] $XMLContent.GPO.ReadTime
+
+            'WMIFilter'                         = $GPO.WmiFilter.name
+            'WMIFilterDescription'              = $GPO.WmiFilter.Description
+            'DistinguishedName'                 = $GPO.Path
+            'SDDL'                              = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
+            'Owner'                             = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'OwnerSID'                          = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'                         = $OwnerType
+            'ACL'                               = @(
+                [PsCustomObject] @{
+                    'Name'           = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+                    'Sid'            = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+                    'PermissionType' = 'Allow'
+                    'Inherited'      = $false
+                    'Permissions'    = 'Owner'
+                }
+                $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
+                    if ($_) {
+                        [PsCustomObject] @{
+                            'Name'           = $_.trustee.name.'#Text'
+                            'Sid'            = $_.trustee.SID.'#Text'
+                            'PermissionType' = $_.type.PermissionType
+                            'Inherited'      = if ($_.Inherited -eq 'false') { $false } else { $true }
+                            'Permissions'    = $_.Standard.GPOGroupedAccessEnum
+                        }
+                    }
+                }
+            )
+            'Auditing'                          = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false }
+            'Links'                             = $XMLContent.GPO.LinksTo | ForEach-Object -Process {
+                if ($_) {
+                    [PSCustomObject] @{
+                        CanonicalName = $_.SOMPath
+                        Enabled       = $_.Enabled
+                        NoOverride    = $_.NoOverride
+                    }
                 }
             }
-        }
-        <#
+            <#
         SOMName SOMPath       Enabled NoOverride
         ------- -------       ------- ----------
         ad      ad.evotec.xyz true    false
         #>
 
-        #| Select-Object -ExpandProperty SOMPath
+            #| Select-Object -ExpandProperty SOMPath
 
+        }
     }
     #break
 }

Private/New-ADForestDrives.ps1

@@ -0,0 +1,56 @@
+function New-ADForestDrives {
+    [cmdletbinding()]
+    param(
+        [string] $ForestName,
+        [string] $ObjectDN
+    )
+    if (-not $Global:ADDrivesMapped) {
+        if ($ForestName) {
+            $Forest = Get-ADForest -Identity $ForestName
+        } else {
+            $Forest = Get-ADForest
+        }
+        if ($ObjectDN) {
+            # This doesn't work because no Domain and no $Server
+            $DNConverted = (ConvertFrom-Distinguishedname -DistinguishedName $ObjectDN -ToDC) -replace '=' -replace ','
+            if (-not(Get-PSDrive -Name $DNConverted -ErrorAction SilentlyContinue)) {
+                try {
+
+                    if ($Server) {
+                        $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Server.Hostname[0] -Scope Global -WhatIf:$false
+                        Write-Verbose "New-ADForestDrives - Mapped drive $Domain / $($Server.Hostname[0])"
+                    } else {
+                        $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Domain -Scope Global -WhatIf:$false
+                    }
+                } catch {
+                    Write-Warning "New-ADForestDrives - Couldn't map new AD psdrive for $Domain / $($Server.Hostname[0])"
+                }
+            }
+        } else {
+            foreach ($Domain in $Forest.Domains) {
+                try {
+                    $Server = Get-ADDomainController -Discover -DomainName $Domain
+                    $DomainInformation = Get-ADDomain -Server $Server.Hostname[0]
+                } catch {
+                    Write-Warning "New-ADForestDrives - Can't process domain $Domain - $($_.Exception.Message)"
+                    continue
+                }
+                $ObjectDN = $DomainInformation.DistinguishedName
+                $DNConverted = (ConvertFrom-Distinguishedname -DistinguishedName $ObjectDN -ToDC) -replace '=' -replace ','
+                if (-not(Get-PSDrive -Name $DNConverted -ErrorAction SilentlyContinue)) {
+                    try {
+                        if ($Server) {
+                            $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Server.Hostname[0] -Scope Global -WhatIf:$false
+                            Write-Verbose "New-ADForestDrives - Mapped drive $Domain / $Server"
+                        } else {
+                            $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Domain -Scope Global -WhatIf:$false
+                        }
+                    } catch {
+                        Write-Warning "New-ADForestDrives - Couldn't map new AD psdrive for $Domain / $Server $($_.Exception.Message)"
+                    }
+                }
+            }
+        }
+        $Global:ADDrivesMapped = $true
+    }
+}

Public/Backup-GPOZaurr.ps1

@@ -2,7 +2,7 @@
     [cmdletBinding(SupportsShouldProcess)]
     param(
         [int] $LimitProcessing,
-        [validateset('All', 'Empty', 'Unlinked', 'EmptyAndUnlinked')][string] $Type = 'All',
+        [validateset('All', 'Empty', 'Unlinked')][string[]] $Type = 'All',
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
@@ -23,67 +23,49 @@
     }
     Process {
         Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOPath $GPOPath | ForEach-Object {
-            #$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-            #$GPOSummary = foreach ($GPO in $GPOs) {
-            #$QueryServer = $ForestInformation['QueryServers'][$_.Domain]['HostName'][0]
-            if ($Type -eq 'All') {
-                Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+            if ($Type -contains 'All') {
+                Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
                 $Count++
                 try {
-                    $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                    $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
                     $BackupInfo
                 } catch {
-                    Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                    Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
                 }
                 if ($LimitProcessing -eq $Count) {
                     break
                 }
-            } elseif ($Type -eq 'Empty') {
+            }
+            if ($Type -notcontains 'All' -and $Type -contains 'Empty') {
                 if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false) {
-                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
                     $Count++
                     try {
-                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
                         $BackupInfo
                     } catch {
-                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                    }
-                    if ($LimitProcessing -eq $Count) {
-                        break
-                    }
-                }
-            } elseif ($Type -eq 'EmptyAndUnlinked') {
-                if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false -or $_.Linked -eq $false) {
-                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
-                    $Count++
-                    try {
-                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
-                        $BackupInfo
-                    } catch {
-                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                    }
-                    if ($LimitProcessing -eq $Count) {
-                        break
-                    }
-                }
-            } elseif ($Type -eq 'Unlinked') {
-                if ($_.Linked -eq $false) {
-                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
-                    $Count++
-                    try {
-                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
-                        $BackupInfo
-                    } catch {
-                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
+                    }
+                    if ($LimitProcessing -eq $Count) {
+                        break
+                    }
+                }
+            }
+            if ($Type -notcontains 'All' -and $Type -contains 'Unlinked') {
+                if ($_.Linked -eq $false) {
+                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
+                    $Count++
+                    try {
+                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                        $BackupInfo
+                    } catch {
+                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
                     }
                     if ($LimitProcessing -eq $Count) {
                         break
                     }
                 }
             }
-
-            #}
-            #$GPOSummary
         }
     }
     End {

Public/Get-GPOZaurr.ps1

@@ -1,13 +1,21 @@
 function Get-GPOZaurr {
     [cmdletBinding()]
     param(
+        [string] $GPOName,
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
         [System.Collections.IDictionary] $ExtendedForestInformation,
-        [string[]] $GPOPath
+        [string[]] $GPOPath,
+
+        [switch] $PermissionsOnly,
+        [switch] $OwnerOnly,
+        [switch] $Limited
     )
     Begin {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         if (-not $GPOPath) {
             $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         }
@@ -15,10 +23,37 @@
     Process {
         if (-not $GPOPath) {
             foreach ($Domain in $ForestInformation.Domains) {
-                Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
-                    Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
-                    $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                    Get-XMLGPO -XMLContent $XMLContent -GPO $_
+                $QueryServer = $ForestInformation.QueryServers[$Domain]['HostName'][0]
+                if ($GPOName) {
+                    Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
+                        Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
+                        if (-not $Limited) {
+                            $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
+                        } else {
+                            $_
+                        }
+                    }
+                } elseif ($GPOGuid) {
+                    Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
+                        Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
+                        if (-not $Limited) {
+                            $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
+                        } else {
+                            $_
+                        }
+                    }
+                } else {
+                    Get-GPO -All -Server $QueryServer -Domain $Domain -ErrorAction SilentlyContinue | ForEach-Object {
+                        Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
+                        if (-not $Limited) {
+                            $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
+                        } else {
+                            $_
+                        }
+                    }
                 }
             }
         } else {
@@ -26,7 +61,7 @@
                 Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object {
                     $XMLContent = [XML]::new()
                     $XMLContent.Load($_.FullName)
-                    Get-XMLGPO -XMLContent $XMLContent
+                    Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent
                 }
             }
         }

Public/Get-GPOZaurrBackupInformation.ps1

@@ -14,7 +14,7 @@
                     $Xml.Backups.BackupInst | ForEach-Object {
                         [PSCustomObject] @{
                             DisplayName      = $_.GPODisplayName.'#cdata-section'
-                            Domain           = $_.GPODomain.'#cdata-section'
+                            DomainName       = $_.GPODomain.'#cdata-section'
                             Guid             = $_.GPOGUid.'#cdata-section'
                             DomainGuid       = $_.GPODomainGuid.'#cdata-section'
                             DomainController = $_.GPODomainController.'#cdata-section'

Public/Get-GPOZaurrPermission.ps1

@@ -0,0 +1,74 @@
+function Get-GPOZaurrPermission {
+    [cmdletBinding(DefaultParameterSetName = 'GPO' )]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')]
+        [string] $GPOName,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [validateSet('Unknown', 'All')][string[]] $Type = 'All',
+
+        [switch] $SkipWellKnown,
+        [switch] $SkipAdministrative,
+        [switch] $ResolveAccounts,
+
+        [switch] $IncludeOwner,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [switch] $IncludeGPOObject,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        if ($Type -eq 'Unknown') {
+            if ($SkipAdministrative -or $SkipWellKnown) {
+                Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
+            }
+        }
+        if ($ResolveAccounts) {
+            $Accounts = @{ }
+            foreach ($Domain in $ForestInformation.Domains) {
+                $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                $DomainInformation = Get-ADDomain -Server $QueryServer
+                $Users = Get-ADUser -Filter * -Server $QueryServer -Properties PasswordLastSet, LastLogonDate, UserPrincipalName
+                foreach ($User in $Users) {
+                    $U = -join ($DomainInformation.NetBIOSName, '\', $User.SamAccountName)
+                    $Accounts[$U] = $User
+                }
+                $Groups = Get-ADGroup -Filter * -Server $QueryServer
+                foreach ($Group in $Groups) {
+                    $G = -join ($DomainInformation.NetBIOSName, '\', $Group.SamAccountName)
+                    $Accounts[$G] = $Group
+                }
+            }
+        }
+
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+            if ($GPOName) {
+                Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
+                    Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                }
+            } elseif ($GPOGuid) {
+                Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
+                    Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                }
+            } else {
+                Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
+                    Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                }
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrPermissions.ps1

@@ -1,75 +0,0 @@
-function Get-GPOZaurrPermissions {
-    [cmdletBinding()]
-    param(
-        [switch] $SkipWellKnownGroup,
-        [alias('ForestName')][string] $Forest,
-        [string[]] $ExcludeDomains,
-        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation
-    )
-    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    foreach ($Domain in $ForestInformation.Domains) {
-        $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-        Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
-            $GPO = $_
-
-            <#
-            DisplayName      : ALL | Enable RDP
-            DomainName       : ad.evotec.xyz
-            Owner            : EVOTEC\Domain Admins
-            Id               : 051bcddf-cc11-427b-bdf0-684c0a6e3ddb
-            GpoStatus        : AllSettingsEnabled
-            Description      :
-            CreationTime     : 07.08.2018 12:47:44
-            ModificationTime : 07.04.2020 22:09:24
-            UserVersion      : AD Version: 1, SysVol Version: 1
-            ComputerVersion  : AD Version: 1, SysVol Version: 1
-            WmiFilter        :
-            #>
-            Get-GPPermissions -Name $GPO.DisplayName -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
-                $GPOPermission = $_
-                #$GPOPermissionFormatted = ConvertTo-TableFormat -InputObject $_
-                [PSCustomObject] @{
-                    DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-                    GUID              = $GPO.ID
-                    DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-                    Enabled           = $GPO.GpoStatus
-                    Description       = $GPO.Description
-                    CreationDate      = $GPO.CreationTime
-                    ModificationTime  = $GPO.ModificationTime
-                    #Owner             = $GPO.Owner       #      : EVOTEC\Domain Admins
-                    #Trustee     = $GPOPermission.Trustee     # : Domain Admins
-                    #TrusteeType       = $GPOPermissionFormatted.TrusteeType # # : Group
-                    Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
-                    Inherited         = $GPOPermission.Inherited   # : False
-                    Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
-                    DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-                    Name              = $GPOPermission.Trustee.Name    #: Domain Admins
-                    Sid               = $GPOPermission.Trustee.Sid     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-                    SidType           = $GPOPermission.Trustee.SidType #: Group
-                }
-            }
-            $SplittedOwner = $GPO.Owner.Split('\')
-            [PSCustomObject] @{
-                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-                GUID              = $GPO.GUID
-                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-                #Owner             = $GPO.Owner       #      : EVOTEC\Domain Admins
-                #Trustee     = $GPOPermission.Trustee     # : Domain Admins
-                #TrusteeType       = $GPOPermissionFormatted.TrusteeType # # : Group
-                Enabled           = $GPO.GpoStatus
-                Description       = $GPO.Description
-                CreationDate      = $GPO.CreationTime
-                ModificationTime  = $GPO.ModificationTime
-
-                Permission        = 'Owner'  # : GpoEditDeleteModifySecurity
-                Inherited         = $false  # : False
-                Domain            = $SplittedOwner[0]  #: EVOTEC
-                DistinguishedName = ''  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-                Name              = $SplittedOwner[1]   #: Domain Admins
-                Sid               = ''     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-                SidType           = '' #: Group
-            }
-        }
-    }
-}

Public/Get-GPOZaurrWmi.ps1

@@ -20,9 +20,9 @@
                     Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
                         $WMI = $_.'msWMI-Parm2' -split ';'
                         [PSCustomObject] @{
-                            Name              = $_.'msWMI-Name'
+                            DisplayName              = $_.'msWMI-Name'
                             Description       = $_.'msWMI-Parm1'
-                            Domain            = $Domain
+                            DomainName            = $Domain
                             NameSpace         = $WMI[5]
                             Query             = $WMI[6]
                             Author            = $_.'msWMI-Author'
@@ -44,9 +44,9 @@
                     Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
                         $WMI = $_.'msWMI-Parm2' -split ';'
                         [PSCustomObject] @{
-                            Name              = $_.'msWMI-Name'
+                            DisplayName              = $_.'msWMI-Name'
                             Description       = $_.'msWMI-Parm1'
-                            Domain            = $Domain
+                            DomainName            = $Domain
                             NameSpace         = $WMI[5]
                             Query             = $WMI[6]
                             Author            = $_.'msWMI-Author'
@@ -68,9 +68,9 @@
                 Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
                     $WMI = $_.'msWMI-Parm2' -split ';'
                     [PSCustomObject] @{
-                        Name              = $_.'msWMI-Name'
+                        DisplayName              = $_.'msWMI-Name'
                         Description       = $_.'msWMI-Parm1'
-                        Domain            = $Domain
+                        DomainName            = $Domain
                         NameSpace         = $WMI[5]
                         Query             = $WMI[6]
                         Author            = $_.'msWMI-Author'

Public/New-GPOZaurrWMi.ps1

@@ -74,7 +74,7 @@
             }
         } else {
             foreach ($_ in $ExistingWmiFilter) {
-                Write-Warning "New-GPOZaurrWMI - Skipping creation of GPO because name: $($_.Name) guid: $($_.ID) for $($_.Domain) already exists."
+                Write-Warning "New-GPOZaurrWMI - Skipping creation of GPO because name: $($_.DisplayName) guid: $($_.ID) for $($_.DomainName) already exists."
             }
         }
     }

Public/Remove-GPOZaurr.ps1

@@ -1,7 +1,7 @@
 function Remove-GPOZaurr {
     [cmdletBinding(SupportsShouldProcess)]
     param(
-        [parameter(Mandatory)][validateset('Empty', 'Unlinked', 'EmptyAndUnlinked')][string] $Type,
+        [parameter(Mandatory)][validateset('Empty', 'Unlinked')][string[]] $Type,
         [int] $LimitProcessing,
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
@@ -28,77 +28,49 @@
     }
     Process {
         Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOPath $GPOPath | ForEach-Object {
-            #$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-
-            #$GPOSummary = foreach ($GPO in $GPOs) {
-            #$QueryServer = $ForestInformation['QueryServers'][$_.Domain]['HostName'][0]
-            if ($Type -eq 'Empty') {
+            if ($Type -contains 'Empty') {
                 if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false) {
                     if ($BackupRequired) {
                         try {
-                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
-                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
+                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
                             $BackupInfo
                         } catch {
-                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
 
                         }
                     }
                     if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
                         try {
-                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain)"
-                            Remove-GPO -Domain $_.Domain -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
+                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.DisplayName) from $($_.DomainName)"
+                            Remove-GPO -Domain $_.DomainName -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
                         } catch {
-                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                        }
-                    }
-                    $Count++
-                    if ($LimitProcessing -eq $Count) {
-                        break
-                    }
-                }
-            } elseif ($Type -eq 'EmptyAndUnlinked') {
-                if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false -or $_.Linked -eq $false) {
-
-                    if ($BackupRequired) {
-                        try {
-                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
-                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
-                            $BackupInfo
-                        } catch {
-                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                        }
-                    }
-                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
-                        try {
-                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain)"
-                            Remove-GPO -Domain $_.Domain -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
-                        } catch {
-                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                        }
-                    }
-                    $Count++
-                    if ($LimitProcessing -eq $Count) {
-                        break
-                    }
-                }
-            } elseif ($Type -eq 'Unlinked') {
-                if ($_.Linked -eq $false) {
-                    if ($BackupRequired) {
-                        try {
-                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
-                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
-                            $BackupInfo
-                        } catch {
-                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                        }
-                    }
-                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
-                        try {
-                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain)"
-                            Remove-GPO -Domain $_.Domain -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
-                        } catch {
-                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
+                        }
+                    }
+                    $Count++
+                    if ($LimitProcessing -eq $Count) {
+                        break
+                    }
+                }
+            }
+            if ($Type -contains 'Unlinked') {
+                if ($_.Linked -eq $false) {
+                    if ($BackupRequired) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
+                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                            $BackupInfo
+                        } catch {
+                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
+                        }
+                    }
+                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.DisplayName) from $($_.DomainName)"
+                            Remove-GPO -Domain $_.DomainName -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
+                        } catch {
+                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
                         }
                     }
                     $Count++
@@ -107,8 +79,6 @@
                     }
                 }
             }
-            #}
-            #$GPOSummary
         }
     }
     End {

Public/Remove-GPOZaurrPermission.ps1

@@ -0,0 +1,77 @@
+function Remove-GPOZaurrPermission {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [Parameter(ParameterSetName = 'GPOName', Mandatory)]
+        [string] $GPOName,
+
+        [Parameter(ParameterSetName = 'GPOGUID', Mandatory)]
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [Parameter(ParameterSetName = 'GPOGUID', Mandatory)]
+        [validateset('Unknown', 'Named')][string[]] $Type,
+
+
+        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [switch] $SkipWellKnown,
+        [switch] $SkipAdministrative,
+
+        [string[]]$NamedObjects,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [int] $LimitProcessing
+    )
+    Begin {
+        $Count = 0
+    }
+    Process {
+        if ($Type -contains 'Named' -and $NamedObjects.Count -eq 0) {
+            Write-Warning "Remove-GPOZaurrPermission - When using type Named you need to provide names to remove. Terminating."
+            return
+        }
+        Get-GPOZaurrPermission -IncludeGPOObject -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -ExcludePermissionType $ExcludePermissionType -IncludePermissionType $IncludePermissionType -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent | ForEach-Object -Process {
+            $GPOPermission = $_
+            if ($Type -contains 'Unknown') {
+                if ($GPOPermission.SidType -eq 'Unknown') {
+                    #Write-Verbose "Remove-GPOZaurrPermission - Removing $($GPOPermission.Sid) from $($GPOPermission.DisplayName) at $($GPOPermission.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, "Removing $($GPOPermission.Sid) from $($GPOPermission.DisplayName) at $($GPOPermission.DomainName)")) {
+                        $GPOPermission.GPOSecurity.RemoveTrustee($GPOPermission.Sid)
+                        $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                        # Set-GPPPermission doesn't work on Unknown Accounts
+                    }
+                    $Count++
+                    if ($Count -eq $LimitProcessing) {
+                        # skipping skips per removed permission not per gpo.
+                        break
+                    }
+                }
+            }
+            if ($Type -contains 'Named') {
+
+                if ($Named -contains $GPOPermission.Sid) {
+                    #Write-Verbose "Remove-GPOZaurrPermission - Removing $($GPOPermission.Sid) from $($GPOPermission.DisplayName) at $($GPOPermission.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, "Removing $($GPOPermission.Sid) from $($GPOPermission.DisplayName) at $($GPOPermission.DomainName)")) {
+                        $GPOPermission.GPOSecurity.RemoveTrustee($GPOPermission.Sid)
+                        $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                        # Set-GPPPermission doesn't work on Unknown Accounts
+                    }
+                    $Count++
+                    if ($Count -eq $LimitProcessing) {
+                        # skipping skips per removed permission not per gpo.
+                        break
+                    }
+                }
+            }
+            #Set-GPPermission -PermissionLevel None -TargetName $GPOPermission.Sid -Verbose -DomainName $GPOPermission.DomainName -Guid $GPOPermission.GUID #-WhatIf
+            #Set-GPPermission -PermissionLevel GpoRead -TargetName 'Authenticated Users' -TargetType Group -Verbose -DomainName $Domain -Guid $_.GUID -WhatIf
+
+        }
+    }
+    End {
+
+    }
+}

Public/Restore-GPOZaurr.ps1

@@ -13,7 +13,7 @@
                 if (-not $SkipBackupSummary) {
                     $BackupSummary = Get-GPOZaurrBackupInformation -BackupFolder $BackupFolder
                     if ($Domain) {
-                        [Array] $FoundGPO = $BackupSummary | Where-Object { $_.DisplayName -eq $DisplayName -and $_.Domain -eq $Domain }
+                        [Array] $FoundGPO = $BackupSummary | Where-Object { $_.DisplayName -eq $DisplayName -and $_.DomainName -eq $Domain }
                     } else {
                         [Array] $FoundGPO = $BackupSummary | Where-Object { $_.DisplayName -eq $DisplayName }
                     }
@@ -21,11 +21,11 @@
                         if ($NewDisplayName) {
                             Import-GPO -Path $BackupFolder -BackupID $GPO.ID -Domain $GPO.Domain -TargetName $NewDisplayName -CreateIfNeeded
                         } else {
-                            Write-Verbose "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) / BackupId: $($GPO.ID)"
+                            Write-Verbose "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.DomainName) / BackupId: $($GPO.ID)"
                             try {
-                                Restore-GPO -Path $BackupFolder -BackupID $GPO.ID -Domain $GPO.Domain
+                                Restore-GPO -Path $BackupFolder -BackupID $GPO.ID -Domain $GPO.DomainName
                             } catch {
-                                Write-Warning "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) failed: $($_.Exception.Message)"
+                                Write-Warning "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.DomainName) failed: $($_.Exception.Message)"
                             }
                         }
                     }
@@ -49,11 +49,11 @@
             } else {
                 $BackupSummary = Get-GPOZaurrBackupInformation -BackupFolder $BackupFolder
                 foreach ($GPO in $BackupSummary) {
-                    Write-Verbose "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) / BackupId: $($GPO.ID)"
+                    Write-Verbose "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.DomainName) / BackupId: $($GPO.ID)"
                     try {
-                        Restore-GPO -Path $BackupFolder -Domain $GPO.Domain -BackupId $GPO.ID
+                        Restore-GPO -Path $BackupFolder -Domain $GPO.DomainName -BackupId $GPO.ID
                     } catch {
-                        Write-Warning "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) failed: $($_.Exception.Message)"
+                        Write-Warning "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.DomainName) failed: $($_.Exception.Message)"
                     }
                 }
             }

Public/Set-GPOZaurrOwner.ps1

@@ -0,0 +1,86 @@
+function Set-GPOZaurrOwner {
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Type')]
+    param(
+        [Parameter(ParameterSetName = 'Type', Mandatory)]
+        [validateset('EmptyOrUnknown', 'NonAdministrative')][string[]] $Type,
+
+        [Parameter(ParameterSetName = 'Named')][string] $GPOName,
+        [Parameter(ParameterSetName = 'Named')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [alias('ForestName')][string] $Forest,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [string[]] $ExcludeDomains,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [Parameter(Mandatory, ParameterSetName = 'Named')]
+        [string] $Principal,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [int] $LimitProcessing
+    )
+    Begin {
+        if ($Type -contains 'NonAdministrative') {
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
+        $Count = 0
+    }
+    Process {
+        if ($Type) {
+            Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Verbose:$false | ForEach-Object -Process {
+                $GPO = $_
+                if ($Type -contains 'NonAdministrative') {
+                    if ($GPO.Owner) {
+                        $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                        $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                        if ($AdministrativeGroup) {
+                            #Write-Verbose "Set-GPOZaurrOwner - Skipping GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName). Already owner $($GPO.Owner)."
+                        } else {
+                            Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                            Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false
+                            $Count++
+                            if ($Count -eq $LimitProcessing) {
+                                break
+                            }
+                        }
+                    }
+                }
+                if ($Type -contains 'EmptyOrUnknown') {
+                    if ($null -eq $GPO.Owner) {
+                        $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                        Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $DefaultPrincipal"
+                        Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false
+                        $Count++
+                        if ($Count -eq $LimitProcessing) {
+                            break
+                        }
+                    }
+                }
+            }
+        } else {
+            Get-GPOZaurr -GPOName $GPOName -GPOGuid $GPOGUiD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Verbose:$false | ForEach-Object -Process {
+                $GPO = $_
+                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
+                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $Principal -Verbose:$false
+                $Count++
+                if ($Count -eq $LimitProcessing) {
+                    break
+                }
+            }
+        }
+    }
+    End {
+
+    }
+}